Struct WebhookRateLimiter 

pub struct WebhookRateLimiter { /* private fields */ }

Per-source-IP token bucket. capacity tokens refill at refill_per_sec tokens/second; each admitted request consumes one. When the bucket empties the next call to WebhookRateLimiter::admit returns false so the handler can refuse with 429.

The map is bounded at max_ips: when an unknown IP would push the map past the cap, the entry with the oldest last_refill timestamp is evicted. That keeps memory bounded under a flood of unique source addresses while letting a steady stream of senders keep their state warm.

Implementations

impl WebhookRateLimiter

pub fn new(capacity: u32, refill_per_sec: f64, max_ips: usize) -> Self

Build a limiter that admits capacity requests up front and then refills at refill_per_sec tokens per second. max_ips caps the tracked set; entries past the cap are evicted oldest first.

pub fn per_minute(rate_per_minute: u32, max_ips: usize) -> Self

Build a limiter from the operator-facing webhook_rate_limit_per_minute knob. The burst depth is the same value (so a fresh sender can fire that many requests back-to-back before throttling kicks in).

pub fn admit(&self, ip: IpAddr) -> bool

Consume one token for ip. Returns true when the request is admitted and false when the bucket is empty.

pub fn admit_at(&self, ip: IpAddr, now: Instant) -> bool

Same as Self::admit but with an explicit now so tests can drive the refill clock deterministically without sleeping.